The problem is reproducible with "Test for Quicktime 608 CC file.mov"
from https://samples.ffmpeg.org/MPEG2/subcc/
ffmpeg_g -i "Test for Quicktime 608 CC file.mov" -map 0 -c copy -y remuxed.mov
Prior to the fix QuickTime Player playback of remuxed.mov would
render cdt2 atom type tags as part of "English CC" subtitles.
---
libavformat/mov.c | 54 +++++++++++++++++++++++++++++++++++++++--------
1 file changed, 45 insertions(+), 9 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 85aef33b19..65b4f3dd5c 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10790,22 +10790,58 @@ static int mov_change_extradata(AVStream *st,
AVPacket *pkt)
static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size)
{
- int new_size, ret;
+ /* We can't make assumptions about the structure of the payload,
+ because it may include multiple cdat and cdt2 samples. */
+ int ret, out_size_max, out_size = 0;
- if (size <= 8)
+ /* a valide payload must have size, 4cc, and at least 1 byte pair: */
+ if (size <= 10 || size % 2 != 0)
return AVERROR_INVALIDDATA;
- new_size = ((size - 8) / 2) * 3;
- ret = av_new_packet(pkt, new_size);
+
+ /* avoid an int overflow: */
+ if ((size - 8) / 2 >= (INT_MAX - size) / 3)
+ return AVERROR_INVALIDDATA;
+
+ /* Allocate the buffer larger enough to store the output cc_data_pkts
+ and the original c608 payload, safely. */
+ out_size_max = ((size - 8) / 2) * 3;
+ ret = av_new_packet(pkt, out_size_max + size);
if (ret < 0)
return ret;
- avio_skip(pb, 8);
- for (int j = 0; j < new_size; j += 3) {
- pkt->data[j] = 0xFC;
- pkt->data[j+1] = avio_r8(pb);
- pkt->data[j+2] = avio_r8(pb);
+ /* Load the original c608 payload into the last 3rd of the buffer. */
+ if (avio_read(pb, pkt->data + out_size_max, size) != size)
+ return AVERROR_EOF;
+
+ /* parse and re-format the c608 payload in one pass. */
+ for (uint8_t *out = pkt->data, *src = out + out_size_max, *end = src +
size; src + 8 <= end; ) {
+ uint32_t atom_size = AV_RB32(src);
+ uint8_t cc_field =
+ memcmp(src + 4, "cdat", 4) == 0 ? 1 :
+ memcmp(src + 4, "cdt2", 4) == 0 ? 2 :
+ 0;
+
+ /* make sure the atom size stays within the buffer boundaries. */
+ if (src + atom_size > end)
+ return AVERROR_INVALIDDATA;
+
+ /* make sure the payload size is consistent with N byte pairs. */
+ if ((atom_size - 8) % 2 != 0)
+ return AVERROR_INVALIDDATA;
+
+ if (cc_field != 0) {
+ for (uint8_t *cc = src + 8, *cc_end = src + atom_size; cc <
cc_end; cc += 2) {
+ out[0] = (0x1F << 3) | (1 << 2) | (cc_field - 1);
+ out[1] = cc[0];
+ out[2] = cc[1];
+ out_size += 3;
+ out += 3;
+ }
+ }
+ src += atom_size;
}
+ av_shrink_packet(pkt, out_size);
return 0;
}
--
2.43.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
